Phishing Explained: How to Recognise Fake Messages and Links

What is phishing?

Phishing is a fake message that pretends to be from someone you trust — your bank, a delivery company, Instagram, even your university. It asks you to click a link or share a code, and its real goal is to steal your password, your money, or both. The name comes from “fishing”: the message is bait, and you are the target.

The 7 warning signs

• Urgency: “Your account will be closed in 2 hours!” Real companies rarely threaten you like this
• Strange sender address: the name looks right, but the email is something like support@bank-secure-login.xyz
• Link does not match: hover (or long-press) the link — the real address is different from the text
• Asking for secrets: passwords, PINs and OTP codes are never requested by message. Ever
• Generic greeting: “Dear customer” instead of your name
• Bad spelling and design: many fake messages have small errors and low-quality logos
• Too good to be true: you “won” a prize in a contest you never entered

What to do when you are not sure

Do not click the link in the message. Instead, open the official app or type the website address yourself, and check there. If the message were real, the information would also be inside your account.

Already clicked?

Change your password immediately from the official site, turn on 2FA, and tell your bank if you entered card details. Acting fast limits the damage.

Go deeper — phishing has cousins

The same trick arrives in other forms: smishing (fake SMS), vishing (fake phone calls, often “from your bank”), and fake QR codes in public places. The defence is identical every time: slow down, verify through the official app or number, and never share codes or passwords under pressure.

Practice task (20 minutes)

Write a fake phishing message yourself — for learning only, never send it to fool anyone — then list every warning sign you planted in it: urgency, wrong link, generic greeting, prize bait. Teaching the signs to a family member protects them more than any software.

Common mistakes to avoid

• Trusting a message because it uses a real logo — logos are copied in seconds
• Clicking “unsubscribe” or reply links inside suspicious messages
• Entering your password on a page you reached from a message link